Adobe ColdFusion CVE-2026-48282: Full RCE Weaponized Within Hours of Disclosure

A Two-Hour Gap Between Disclosure and Exploitation

On June 30, 2026, Adobe shipped security bulletin APSB26-68, resolving 11 ColdFusion vulnerabilities, including seven flaws rated the maximum CVSS score of 10.0 — six in ColdFusion itself and one in the unrelated Campaign Classic product, according to The Hacker News. That June 2026 patch cycle drew the usual mix of attention from patch-management teams juggling a busy release; at the time, Adobe said it was not aware of any active exploitation.

That changed fast. Security researchers at WatchTowr Labs published a technical breakdown of the ColdFusion bulletin on July 2, and KEVIntel’s honeypot network detected in-the-wild exploitation of CVE-2026-48282 within roughly two hours of that analysis going public. Adobe’s “we’re not aware of exploitation” note, accurate at patch time, was stale within 48 hours. CISA confirmed the pattern by adding the CVE to its Known Exploited Vulnerabilities catalog on July 7, and under Binding Operational Directive 26-04, ordered federal civilian agencies to remediate by July 10 — a compliance clock that closes the same week this July 2026 article publishes.

CVE-2026-48282 sits in ColdFusion’s Remote Development Services (RDS), a legacy feature that lets IDEs talk to a ColdFusion server over HTTP to browse the filesystem, run database queries, and assist with debugging. According to Resecurity’s technical analysis, the flaw lives in RDS’s FILEIO handler, which processed user-supplied file paths without canonicalizing them or checking they stayed inside an approved directory. Adobe’s fix, by contrast, “introduced canonical path resolution before any file operation” and added explicit rejection of traversal sequences and absolute paths — a textbook illustration of what the vulnerable code was missing in the first place.

The practical exploitation chain, at a high level and without reproducing attack specifics, runs in three stages: an attacker locates an internet-facing RDS endpoint, confirms the path-traversal bug allows writing a file outside the intended directory, and places a file inside a location the web server will serve. Once that file is reachable over HTTP, it executes with the privileges of the ColdFusion service account — full remote code execution, no authentication required, as long as RDS is enabled with authentication disabled. The Shadowserver Foundation was tracking roughly 750 internet-facing ColdFusion servers at the time of disclosure — not a huge number by internet-scale standards, but ColdFusion deployments skew toward legacy government, healthcare, and financial-services systems where a single compromised server often sits closer to sensitive data than its modest footprint suggests. That exposure count, tallied as researchers watched exploitation spread in early July 2026, is expected to keep falling as agencies race the BOD 26-04 deadline.

Affected versions are ColdFusion 2025 (version 2025.9 and earlier, fixed in Update 10) and ColdFusion 2023 (version 2023.20 and earlier, fixed in Update 21). Adobe assigned the fix Priority Rating 1 — its highest urgency tier — and the Canadian Centre for Cyber Security issued its own advisory based on the open-source exploitation reporting, a signal that national CERTs outside the United States are treating this as more than a routine patch-Tuesday item.

What ColdFusion Operators Should Do Right Now

1. Patch to ColdFusion 2025 Update 10 or 2023 Update 21 immediately — don’t wait for a maintenance window

The two-hour gap between technical disclosure and exploitation means the traditional patch cadence — validate in staging, schedule a change window, deploy within a week — is no longer fast enough for a Priority 1, CVSS 10.0 flaw with a public technical write-up. If a server is internet-facing, treat this as an emergency change: apply the update outside the normal cycle, and only afterward run full regression testing. Adobe itself flagged this bulletin as targeting vulnerabilities “with a higher risk of being targeted… in the wild,” which is as close to an explicit warning as a vendor advisory gets.

2. Disable RDS entirely if you don’t actively use it — most production servers don’t need it

RDS is a development-and-debugging convenience, not a production requirement. If your ColdFusion instance is not actively used by remote IDE tooling — and in most production deployments it is not — disable the RDS service outright rather than relying on authentication settings alone. Exploitation of CVE-2026-48282 specifically requires RDS to be enabled with RDS authentication disabled, so removing the feature closes the door regardless of patch timing, and it removes an entire class of future RDS-related CVEs from your attack surface at the same time.

3. Hunt for indicators of compromise before declaring the incident closed

Patching stops new exploitation; it does not undo exploitation that already happened. Given the compressed exploitation window, any internet-facing ColdFusion server that was reachable between late June and the patch date should be checked for unauthorized files in the web root and /CFIDE/ directories, unexpected scheduled tasks, and new local or service accounts. Cross-reference server logs against the July 2 disclosure date — requests hitting RDS endpoints before your patch was applied are the highest-priority signal to investigate first.

4. Move ColdFusion admin and RDS interfaces off the public internet

Beyond this specific CVE, the structural fix is architectural: administrative and development-tooling endpoints should never be reachable directly from the internet. Put RDS, the ColdFusion Administrator console, and similar management interfaces behind a VPN or an authenticated reverse proxy with IP allow-listing. This does not replace patching — Adobe’s fix must still be applied — but it converts a future zero-day in the same subsystem from an internet-wide emergency into a contained, internal risk.

The Bigger Picture: When Patch Windows Become Attack Windows

The two-hour gap here is not a one-off. It fits a trend security teams have watched compress for several years: the time between a patch (or a technical write-up explaining a patch) and mass exploitation keeps shrinking, driven by faster patch-diffing tooling and, increasingly, by attackers using the same AI-assisted analysis techniques that researchers use to find bugs in the first place. Adobe’s own response to this pressure is telling — the company is moving ColdFusion and Campaign Classic from monthly to twice-monthly security bulletins, on the second and fourth Tuesday of each month starting July 14, 2026, citing accelerated vulnerability discovery using AI models as the reason.

That shift matters more than the patch count. If AI tooling is compressing both vulnerability discovery and exploit development, “patch within a week” stops being a defensible SLA for internet-facing, high-severity CVEs — it becomes a description of exactly how long a server stays exploitable after disclosure. Security teams that still treat CVSS 10.0 advisories as routine backlog items, rather than same-day emergencies, are building their patch program for a threat landscape that no longer exists.

Frequently Asked Questions

Sources & Further Reading

• Attackers exploit critical Adobe ColdFusion vulnerability (CVE-2026-48282) — Help Net Security
• Adobe Patches 7 CVSS 10.0 Flaws in ColdFusion and Campaign Classic — The Hacker News
• Critical Adobe ColdFusion Vulnerability Exploited in Attacks — SecurityWeek
• CVE-2026-48282: Adobe ColdFusion RDS Path Traversal Leading to RCE — Resecurity
• Known Exploited Vulnerabilities Catalog — CISA
• Adobe Security Bulletin APSB26-68 — Adobe